MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a9b35797c4c9245cad7d96c3cea700794e3b3b21fd080c6780511d41489c379. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a9b35797c4c9245cad7d96c3cea700794e3b3b21fd080c6780511d41489c379
SHA3-384 hash: 8be99c1419f0b2f60e7b2cb20e2955c59b1a4dbe72aaf0d3e09dc5e9bed2812f805dbdd7f8d106e798862d64eb22fde6
SHA1 hash: e55e9e83863cd427c4dd01af65754d6e08991fe7
MD5 hash: b4f9652e9ab50cf4f6d17b2c1df16111
humanhash: florida-arkansas-zulu-november
File name:Order1.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:814'924 bytes
First seen:2021-02-11 06:20:15 UTC
Last seen:2021-02-12 00:19:50 UTC
File type: rar
MIME type:application/x-rar
ssdeep 24576:dJmLYYF4SF/wShtv/gIx5stLfN2BN4K07wI32Nt0:iFcorTBN4sIGD0
TLSH E5053384229B4F3356297A4E9F4AC9493EC4EF72CFAC66F4D6467899044D60BCD43A3C
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""admin-alliancetears.co.uk" <admin@alliancetears.co.uk>" (likely spoofed)
Received: "from mail.alliancetears.co.uk (mail.alliancetears.co.uk [167.99.219.110]) "
Date: "Thu, 11 Feb 2021 16:18:15 -0800"
Subject: "Urgent Order"
Attachment: "Order1.rar"

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7a9b35797c4c9245cad7d96c3cea700794e3b3b21fd080c6780511d41489c379/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-02-10 23:42:16 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pkntk6l4jsjelswx3fwdz2tqa6kohm5sd7iibrtyaui5ifejyn4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7a9b35797c4c9245cad7d96c3cea700794e3b3b21fd080c6780511d41489c379

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 7a9b35797c4c9245cad7d96c3cea700794e3b3b21fd080c6780511d41489c379

(this sample)

AgentTesla

Executable exe 8dbc2986e3c9443954594755f4d22898973147cbd8bf0ee47d7bc402c8ff8425

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8dbc2986e3c9443954594755f4d22898973147cbd8bf0ee47d7bc402c8ff8425
  
Dropping
AgentTesla
  
Dropping
SHA256 0e365aca3f6a945befe7e6f6e59d184719abc62d312e1bf2c9a873062ab5aa5f

Comments